Path sanitization in C++

Question

I'm writing a small read-only FTP-like server. Client says "give me that file" and my server sends it.

Is there any standard way (a library function?!?) to make sure that the file requested is not "../../../../../etc/passwd" or any other bad thing? It would be great if I could limit all queries to a directory (and its subdirectories).

Thank you!

Answer 1

Chroot is probably the best way to go, but you can use realpath(3) to determine the canonical path to a given filename. From the man page:

 char *realpath(const char *file_name, char *resolved_name);

The realpath() function resolves all symbolic links, extra '/' characters, and references to /./ and /../ in filename, and copies the resulting absolute pathname into the memory referenced by resolved name. The resolved_name argument must refer to a buffer capable of storing at least PATH_MAX characters.

From there you can restrict the request in any additional way you like.

Answer 2

Also take a look at chroot